cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1811
Views
1
Helpful
3
Replies

4506 switch SPAN limitations

eddie5170
Level 1
Level 1

I created 8 monitor sessions already with 1 destination port each,  but I'm unable to create a 9th  session. We have a lot of Proof of  concepts running and do you know how i  can do SPAN for multple  destination hosts, more than 8?

I need a solution.... See config  error  below:

ROM: 15.0(1r)SG2

Jawa Revision 7, Snowtrooper Revision 0x0.0x15

NSEVCisco4500 uptime is 1 year, 9 weeks, 1 day, 12 hours, 6 minutes

System returned to ROM by power-on

Running default software

License Information for 'WS-X45-SUP7-E'

    License Level: ipbase   Type: Permanent

    Next reboot license Level: ipbase

cisco WS-C4506-E (MPC8572) processor (revision 8) with 786516K/16384K bytes of memory.

Thanks

Edmund

1 Accepted Solution

Accepted Solutions

daniel.dib
Level 7
Level 7

Hi Edmund,

You can have a maximum of 8 sessions at the same time:

Note

Catalyst 4900M, Catalyst 4948E, Supervisor Engine 6-E, and Supervisor Engine 6L-E allow a maximum of 16 SPAN/RSPAN sessions ( 8 concurrent sessions with Rx sources and 8 concurrent sessions with Tx sources). Bidirectional sources count as both Rx and Tx. All other supervisor engines allow a maximum of 6 sessions (2 concurrent sessions with RX sources and 4 concurrent sessions with Txsources).

The only solution I can think of is to send SPAN traffic to RSPAN VLAN to another switch and run captures there as well. Or send traffic on a port to some kind of network tap with multiple ports.

Daniel Dib
CCIE #37149
CCDE #20160011

Please rate helpful posts.

View solution in original post

3 Replies 3

daniel.dib
Level 7
Level 7

Hi Edmund,

You can have a maximum of 8 sessions at the same time:

Note

Catalyst 4900M, Catalyst 4948E, Supervisor Engine 6-E, and Supervisor Engine 6L-E allow a maximum of 16 SPAN/RSPAN sessions ( 8 concurrent sessions with Rx sources and 8 concurrent sessions with Tx sources). Bidirectional sources count as both Rx and Tx. All other supervisor engines allow a maximum of 6 sessions (2 concurrent sessions with RX sources and 4 concurrent sessions with Txsources).

The only solution I can think of is to send SPAN traffic to RSPAN VLAN to another switch and run captures there as well. Or send traffic on a port to some kind of network tap with multiple ports.

Daniel Dib
CCIE #37149
CCDE #20160011

Please rate helpful posts.

Hi Daniel,

See attached for the solution overview.

Is that possible to do?

All switches will function as layer 2 except for the 6500 and the juniper SRX.

And just a bit of a background history, we currently have a 3560 switch that does all the SPAN session (connecting to the endace DAC) and we want to decomission that and replace it with 4506-E x2. 

**Note: I did not design the topolgy as i ma just a new guy in the company**

Regards

Edmund

Yes, that's how I would do it to overcome the limitation. Looks good to me.

Daniel Dib
CCIE #37149

Daniel Dib
CCIE #37149
CCDE #20160011

Please rate helpful posts.
Review Cisco Networking for a $25 gift card